GCVE - cpe:2.3:a:roxy-wi:roxy-wi:8.0:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:roxy-wi:roxy-wi:8.0:*:*:*:*:*:*:*

part: a version: 8.0 update: *

Notes

Imported from NVD CPE 2.0 feed

PURL	Source	Last updated
`pkg:github/hap-wi/roxy-wi`	purl2cpe	2026-06-01 10:15:27.141536

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2024-43804`	vulnerable	2026-06-08 06:45:53.076012	OS Command Injection via Port Scan Functionality in Roxy-WI HIGH (8.8) Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers. An OS Command Injection vulnerability allows any authenticated user on the application to execute arbitrary code on the web application server via port scanning functionality. User-supplied input is used without validation when constructing and executing an OS command. User supplied JSON POST data is parsed and if "id" JSON key does not exist, JSON value supplied via "ip" JSON key is assigned to the "ip" variable. Later on, "ip" variable which can be controlled by the attacker is used when constructing the cmd and cmd1 strings without any extra validation. Then, server_mod.subprocess_execute function is called on both cmd1 and cmd2. When the definition of the server_mod.subprocess_execute() function is analyzed, it can be seen that subprocess.Popen() is called on the input parameter with shell=True which results in OS Command Injection. This issue has not yet been patched. Users are advised to contact the Roxy-WI to coordinate a fix. Published: 2024-08-29T16:45:05.740Z Updated: 2024-08-29T17:06:50.680Z Open on db.gcve.eu Reference links https://github.com/roxy-wi/roxy-wi/security/advisories/GHSA-qc52-vwwj-5585	Imported from gcve-enriched-dumps CVE data

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.